MediaWiki-l April 2025

mediawiki-l@lists.wikimedia.org

8 participants
11 discussions

Recent parser change regarding tildes in comments?
by Thomas Dalton 17 Aug '25

17 Aug '25

Has the parser just been changed with regards to tildes (~~~~) inside HTML comments? It appears they used to be ignored, and are now suddenly being replaced en masse the next time someone edits the page (and can't be easily reverted - it just changes the sig to the reverter's instead). See http://en.wikipedia.org/wiki/Wikipedia:Articles_for_creation/2006-06-02-ear… for an example.

4 3

Magnolia677 deserved the death threats I made to her because she was attacking me and calling my edits stupid
by MidAtlanticBaby . 11 Aug '25

11 Aug '25

So apparently y'all care more about the people that hurt me than y'all care about me? So y'all are going to IGNORE THE FACT that Magnolia677 WENT OFF ON me because i was making a bunch of edits to Florida county articles that she and 3 other admins didnt like me making and then I got REPORTED by ANOTHER EDITOR to ANI for STANDING UP for myself against her ATTACKING me? And y'all are gonna ASSUME i made the death threats for no reason for my own fucking ENJOYMENT? Y'all are ALLOWED to be an asshole to me and im not supposed to be an asshole to you back? Do y'all not have any respect for other people or their emotions? Is that like y'all's GOAL, to MAKE people suffer for the rest of THEIR FUCKING LIFE when they get blocked on a wiki and they GET MAD about it and take it out RIGHTFULLY on the person that blocked them? Are y'all nothing but some sadistic ass racist ass motherfuckers who want everything to go THEIR WAY and who want to control OTHER PEOPLE'S emotions or how they feel about their block? Are y'all JUSTIFYING Magnolia's and Drmies' actions towards me because theyre white and I'M black?

4 3

Security and maintenance release: 1.39.12 / 1.42.6 / 1.43.1
by Sam Reed 15 Apr '25

15 Apr '25

2 1

Upgrade trouble MediaWiki 1.39.1 to MediaWiki 1.43.1
by rogerchrisman＠gmail.com 13 Apr '25

13 Apr '25

Dear Wikians, I am having trouble upgrading teflpedia.com from MediaWiki 1.39.1 to MediWiki 1.43.1. I tried webgetting MediaWiki 1.43.1 and then running "php maintenance/run.php update" and it kinda worked, but I couldn't log in. Got a log in error like this: ------------------------------- Database error A database query error has occurred. This may indicate a bug in the software. ! [c93cfb4e1d37618f6a3dcd5f] 2025-04-11 23:55:53: Fatal exception of type "Wikimedia\Rdbms\DBQueryError" ------------------------------ So I tried a clean fresh Web install of MediaWiki 1.43.1 onto a clean new database (that I created in cPanel first). I selected all the extensions and options except Use Commons Images. That worked. Blank new MediaWiki 1.43.1. I can log in with no error. But I need my wiki and all its pages. So I restored my wiki database using cPanel > Backup > Restore A Database Backup and my wiki's MediaWiki 1.39.1 database backup that I had made with cPanel yesterday. And then ran "php maintenance/run.php update". Output snip below. Now I have my wiki pages, but I get the above login error again. A similar error message appears when you try to visit https://teflpedia.com/index.php/Special:SpecialPages I put $wgShowExceptionDetails = true; at the bottom on LocalSettings.php in teflpedia.com but don't see any details from that showing. Do you see any hints in the below "php maintanance/run.php update" output what may be causing the above error? Any clues at all will be greatly appreciated. Thank you, Roger -----------------------snip of very long maintenance/update.php output -------------------------- Running MediaWiki\Extension\AbuseFilter\Maintenance\MigrateActorsAF... Beginning migration of abuse_filter.af_user and abuse_filter.af_user_text to abuse_filter.af_actor ... af_id=16 Completed migration, updated 16 row(s) with 0 new actor(s), 0 error(s) Beginning migration of abuse_filter_history.afh_user and abuse_filter_history.afh_user_text to abuse_filter_history.afh_actor ... afh_id=16 Completed migration, updated 16 row(s) with 0 new actor(s), 0 error(s) done. Table abuse_filter contains af_user field. Dropping...done. Table abuse_filter_history contains afh_user field. Dropping...done. ...discussiontools_subscription table already exists. ...discussiontools_items table already exists. ...echo_event table already exists. ...echo_push_provider table already exists. ...echo_push_subscription table already exists. ...echo_push_topic table already exists. ...index eps_user already set on echo_push_subscription table. ...echo_push_subscription_token key doesn't exist. ...index eps_token already set on echo_push_subscription table. ...have eps_topic field in echo_push_subscription table. ...echo_unread_wikis table already exists. ...linter table already exists. ...have linter_namespace field in linter table. ...have linter_template field in linter table. Modifying linter_params field of table linter...done. ...loginnotify_seen_net table already exists. Dropping table mathoid ...done. Dropping table mathlatexml ...done. Running MediaWiki\Extension\OATHAuth\Maintenance\UpdateTOTPScratchTokensToArray... Done. done. Running MediaWiki\Extension\OATHAuth\Maintenance\UpdateForMultipleDevicesSupport... Wikimedia\Rdbms\DBQueryError from line 1198 of /home/bilbo/public_html/teflpedia/includes/libs/rdbms/database/Database.php: Error 1146: Table 'bilbo_teflpedia.oathauth_types' doesn't exist Function: MediaWiki\Extension\OATHAuth\OATHAuthModuleRegistry::getModuleIdsFromDatabase Query: SELECT oat_id,oat_name FROM `oathauth_types` #0 /home/bilbo/public_html/teflpedia/includes/libs/rdbms/database/Database.php(1182): Wikimedia\Rdbms\Database->getQueryException() #1 /home/bilbo/public_html/teflpedia/includes/libs/rdbms/database/Database.php(1156): Wikimedia\Rdbms\Database->getQueryExceptionAndLog() #2 /home/bilbo/public_html/teflpedia/includes/libs/rdbms/database/Database.php(647): Wikimedia\Rdbms\Database->reportQueryError() #3 /home/bilbo/public_html/teflpedia/includes/libs/rdbms/database/Database.php(1345): Wikimedia\Rdbms\Database->query() #4 /home/bilbo/public_html/teflpedia/includes/libs/rdbms/database/DBConnRef.php(127): Wikimedia\Rdbms\Database->select() #5 /home/bilbo/public_html/teflpedia/includes/libs/rdbms/database/DBConnRef.php(351): Wikimedia\Rdbms\DBConnRef->__call() #6 /home/bilbo/public_html/teflpedia/includes/libs/rdbms/querybuilder/SelectQueryBuilder.php(745): Wikimedia\Rdbms\DBConnRef->select() #7 /home/bilbo/public_html/teflpedia/extensions/OATHAuth/src/OATHAuthModuleRegistry.php(132): Wikimedia\Rdbms\SelectQueryBuilder->fetchResultSet() #8 /home/bilbo/public_html/teflpedia/extensions/OATHAuth/src/OATHAuthModuleRegistry.php(93): MediaWiki\Extension\OATHAuth\OATHAuthModuleRegistry->getModuleIdsFromDatabase() #9 /home/bilbo/public_html/teflpedia/extensions/OATHAuth/maintenance/UpdateForMultipleDevicesSupport.php(56): MediaWiki\Extension\OATHAuth\OATHAuthModuleRegistry->getModuleIds() #10 /home/bilbo/public_html/teflpedia/maintenance/includes/LoggedUpdateMaintenance.php(51): MediaWiki\Extension\OATHAuth\Maintenance\UpdateForMultipleDevicesSupport->doDBUpdates() #11 /home/bilbo/public_html/teflpedia/includes/installer/DatabaseUpdater.php(1140): MediaWiki\Maintenance\LoggedUpdateMaintenance->execute() #12 /home/bilbo/public_html/teflpedia/includes/installer/DatabaseUpdater.php(595): MediaWiki\Installer\DatabaseUpdater->runMaintenance() #13 /home/bilbo/public_html/teflpedia/includes/installer/DatabaseUpdater.php(552): MediaWiki\Installer\DatabaseUpdater->runUpdates() #14 /home/bilbo/public_html/teflpedia/maintenance/update.php(195): MediaWiki\Installer\DatabaseUpdater->doUpdates() #15 /home/bilbo/public_html/teflpedia/maintenance/includes/MaintenanceRunner.php(703): UpdateMediaWiki->execute() #16 /home/bilbo/public_html/teflpedia/maintenance/run.php(51): MediaWiki\Maintenance\MaintenanceRunner->run() #17 {main}

2 2

MediaWiki Extensions and Skins Security Release Supplement (1.39.12/1.42.6/1.43.1)
by Scott Bassett 11 Apr '25

11 Apr '25

Greetings- ...and hopefully one last round of apologies. It was pointed out that the _contents_ of the previous release emails were _also_ incorrect, as opposed to just the relevant versions of MediaWiki. The following is both the correct content (released security issues) and relevant MediaWiki versions. With the security/maintenance release of MediaWiki 1.39.12/1.42.6/1.43.1, we would also like to provide this supplementary announcement of MediaWiki extensions and skins with now-public Phabricator tasks, security patches and backports [1]: SimpleCalendar + (T383472, CVE-2025-32077) - XSSes in Extension:SimpleCalendar https://gerrit.wikimedia.org/r/q/Ic5b5ce8f7791026eff1aafffb32a68f3aab119be VersionCompare + (T384269, CVE-2025-32078) - XSSes and potential RCE in Special:VersionCompare https://gerrit.wikimedia.org/r/q/If901b3b98e615e1a4f4034d932d2d592000b51d0 GrowthExperiments + (T384244, CVE-2025-32079) - Saving the right content to MediaWiki:GrowthMentors.json can take down the site https://gerrit.wikimedia.org/r/c/mediawiki/extensions/GrowthExperiments/+/1… MobileFrontend + (T366402, CVE-2025-32080) - Cross-origin data leak in mobilefrontend via lazy load images https://gerrit.wikimedia.org/r/c/mediawiki/extensions/MobileFrontend/+/1123… VisualData + (T385935, CVE-2025-32076) - Evil regex used to process user-provided data in VisualData https://gerrit.wikimedia.org/r/c/mediawiki/extensions/VisualData/+/1121732 FeedUtils + (T386175, CVE-2025-32072) - HTML injection in feed output from i18n message https://gerrit.wikimedia.org/r/c/mediawiki/core/+/1120134 HTMLTags + (T386337, CVE-2025-32073) - System message XSS in HTMLTags https://gerrit.wikimedia.org/r/c/mediawiki/extensions/HTMLTags/+/1121056 ConfirmAccount + (T386908, CVE-2025-32074) - XSSes in Extension:ConfirmAccount https://gerrit.wikimedia.org/r/q/I86f47103ffb78c671890b44ccd59fcff6613975f Tabs + (T386887, CVE-2025-32075) - IP and user agent leaks in Extension:Tabs https://gerrit.wikimedia.org/r/q/I03bec9528ee3ed05f35187458cde4e2fc4b51092 GrowthExperiments + (T386963, CVE-2025-32067) - i18n XSS vulnerability in message growthexperiments https://gerrit.wikimedia.org/r/c/mediawiki/extensions/GrowthExperiments/+/1… OAuth + (T336113, CVE-2025-32068) - Revoking authorization of OAuth2 consumer does not invalidate refresh tokens https://gerrit.wikimedia.org/r/q/I27b61af2cdfb862a42432e7a87b863033d540cfc WikibaseMediaInfo + (T387691, CVE-2025-32069) - Wikitext stored XSS on filepages due to dangerous WBMI serialization https://gerrit.wikimedia.org/r/q/Ie969a8cfeab0d4457417773fa884e271968e5657 AJAXPoll + (T389590, CVE-2025-32070) - XSSes in AJAXPoll https://gerrit.wikimedia.org/r/q/Ib59c59b2cd36928ab200149c851e2bfcf5cf920c Wikibbase + (T389369, CVE-2025-32071) - Wikibase CommonsInlineImageFormatter: i18n XSS https://gerrit.wikimedia.org/r/q/Iac1f1c27054bfd1a4a4251281ab8c72f59204a90 The Wikimedia Security Team recommends updating these extensions and/or skins to the current master branch or relevant, supported release branch [2] as soon as possible. Some of the referenced Phabricator tasks above _may_ still be private. Unfortunately, when security issues are reported, sometimes sensitive information is exposed and since Phabricator is historical, we cannot make these tasks public without exposing this sensitive information. If you have any additional questions or concerns regarding this update, please feel free to contact security(a)wikimedia.org or file a security task within Phabricator [3]. [1] https://phabricator.wikimedia.org/T382326 [2] https://www.mediawiki.org/wiki/Version_lifecycle [3] https://www.mediawiki.org/wiki/Reporting_security_bugs -- Scott Bassett sbassett(a)wikimedia.org

1 0

Re: The Recent MediaWiki Extensions and Skins Security Release Supplement
by Scott Bassett 11 Apr '25

11 Apr '25

Hello - One small correction regarding the recent MediaWiki Extensions and Skins Security Release Supplement announcement emails - within their email subject and the first paragraph of the announcement, it was stated that these releases were for MediaWiki versions 1.39.9, 1.41.3 and 1.42.2. This is incorrect. The correct versions for this release are 1.39.12, 1.42.6 and 1.43.1 per the now-public security release task [0]. We apologize for this error. [0] https://phabricator.wikimedia.org/T382326 -- Scott Bassett sbassett(a)wikimedia.org

1 0

MediaWiki Extensions and Skins Security Release Supplement (1.39.9/1.41.3/1.42.2)
by Maryum Styles 11 Apr '25

11 Apr '25

Greetings- With the security/maintenance release of MediaWiki 1.39.9/1.41.3/1.42.2, we would also like to provide this supplementary announcement of MediaWiki extensions and skins with now-public Phabricator tasks, security patches and backports [1]: PageTriage + (T366991, CVE-2024-47848) - User can review/unreview articles while blocked https://gerrit.wikimedia.org/r/q/I0288a715f7040a14ab7f70b2888fe1ef77a44588 CSS + (T368594, CVE-2024-47845) - CSS sanitizer used incorrectly https://gerrit.wikimedia.org/r/q/I6f38f4a8fc1dcd690ab27b8f18ce6ca903bacc53 Widgets + (T370022, CVE-2024-35226) - smarty library version has CVE https://gerrit.wikimedia.org/r/q/I18f161c338f8c52477a766524c255a31879d5e63 Cargo + (T370632, CVE-2024-47849) - Backticks can allow the usage of not-allowed SQL functions https://gerrit.wikimedia.org/r/c/mediawiki/extensions/Cargo/+/1055963 Cargo + (T372209, CVE-2024-47846) - Special:DeleteCargoTable and Special:SwitchCargoTable have no CSRF protection https://gerrit.wikimedia.org/r/c/mediawiki/extensions/Cargo/+/1062723 Cargo + (T372211, CVE-2024-47847) - Various XSSes found in Cargo https://gerrit.wikimedia.org/r/c/mediawiki/extensions/Cargo/+/1063804 https://gerrit.wikimedia.org/r/c/mediawiki/extensions/Cargo/+/1063806 https://gerrit.wikimedia.org/r/c/mediawiki/extensions/Cargo/+/1063827 https://gerrit.wikimedia.org/r/c/mediawiki/extensions/Cargo/+/1063831 Apex + (T370081, CVE-2024-47840) - Stored XSS through sidebar https://gerrit.wikimedia.org/r/q/Id9093783051c3f8e6dcb5dc89f9493a5f5cf7bd7 CSS + (T369486, CVE-2024-47841) - Path traversal when loading stylesheets https://gerrit.wikimedia.org/r/q/I46613d8d50fc978bdac58e2b312ee03324c1edc8 DataTransfer + (T375358, CVE-2024-45048, CVE-2024-45046) - vulnerable version of `phpoffice/phpspreadsheet` https://gerrit.wikimedia.org/r/c/mediawiki/extensions/DataTransfer/+/1074761 The Wikimedia Security Team recommends updating these extensions and/or skins to the current master branch or relevant, supported release branch [2] as soon as possible. Some of the referenced Phabricator tasks above _may_ still be private. Unfortunately, when security issues are reported, sometimes sensitive information is exposed and since Phabricator is historical, we cannot make these tasks public without exposing this sensitive information. If you have any additional questions or concerns regarding this update, please feel free to contact security(a)wikimedia.org or file a security task within Phabricator [3]. [1] https://phabricator.wikimedia.org/T368628 [2] https://www.mediawiki.org/wiki/Version_lifecycle [3] https://www.mediawiki.org/wiki/Reporting_security_bugs

1 0

Security pre-release announcement: 1.39.12 / 1.42.6 / 1.43.1
by Sam Reed 09 Apr '25

09 Apr '25

Hi all, Apologies for this release being late, as it was due in the last week of March. Unfortunately, due to the events of [2], that took priority in terms of resources. On Thursday we will be issuing a security and maintenance release to all supported branches of MediaWiki. The new releases will be: - 1.39.12 - 1.42.6 - 1.43.1 This will also resolve a security issue in a bundled extension, along with bug fixes included for maintenance reasons. These security issues also affect many unsupported versions of MediaWiki. We will make the fixes available in the respective release branches and master in git. Tarballs will be available for the above mentioned point releases as well. A summary of some of the security fixes that have gone into non-bundled MediaWiki extensions will also follow later. As a reminder, MediaWiki 1.35 became end of life (EOL) in December 2023, MediaWiki 1.40 became EOL in June 2024 and MediaWiki 1.41 became EOL in December 2024. MediaWiki 1.39 (the old LTS before 1.43) becomes EOL in November 2025. It is strongly recommended to upgrade to either 1.42, which will be supported until June 2025, or ideally to 1.43 (the next LTS after 1.39), which will be supported until December 2027. [1] https://www.mediawiki.org/wiki/Version_lifecycle [2] https://meta.wikimedia.org/wiki/Wikimedia_Foundation/March_2025_discovery_o…

1 0

Cargo query and fixed header for a table
by Philip Teyssier 08 Apr '25

08 Apr '25

I would like to run a Cargo query (100+ records) which calls a template set up as a table. The first two rows of the table would be the fixed header, then each row of records after that is the Cargo data. I don't know how to fix the table header and that is where I need help. I know I can format a Cargo query by setting format=table, but that that provides limited formatting options. Also, speaking of Cargo query tables, how do I change the first column "_pageName" to something else? Thanks everyone! Philip Teyssier philip(a)atomic-inc.com<mailto:philip@atomic-inc.com>

1 0

Proszę pomusz cię mi,
by Jagoda Stachowiak 06 Apr '25

06 Apr '25

1 0

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

2004

2003

MediaWiki-l April 2025